v0.1.15

Fix

• MCP OAuth callback was returning `{"code":"rest_forbidden","status":401}` on production even for logged-in admins. Root cause: WP REST's standard cookie auth requires an `X-WP-Nonce` header, but top-level browser redirects from the OAuth provider (Asana, Figma) can't carry a nonce, so the callback was rejected before the handler ran. Authenticate via `wp_validate_auth_cookie()` directly — CSRF is already covered by the OAuth `state` parameter (bound to user_id in the pending transient).